Microsoft Patch Tuesday with active zero-days

Google fixed multiple vulnerabilities in Chrome, including critical and high-severity flaws, while Mozilla fixed two critical bugs already being actively exploited. ACN and other sources reported vulnerabilities in enterprise products such as Cisco RoomOS, IBM WebSphere, Splunk, and Citrix, often with impacts on authentication, access to sensitive information, or arbitrary file write. This kind of patch wave matters because it hits the software layers used as entry points, collaboration channels, or platform components. Organizations that ignore secondary vendors risk leaving surfaces exposed even if they have already covered the main operating systems. The lesson is that remediation must be multi-vendor and coordinated, not limited only to endpoints.

The flaws include CVE-2026-15409, a critical SSRF that allows a remote unauthenticated attacker to force the device to make requests to arbitrary destinations, and CVE-2026-15410, a post-authentication code injection vulnerability that can lead to command execution on the operating system. The response guidance is severe: if IoCs appear, SonicWall recommends re-imaging hardware appliances or redeploying virtual instances, in addition to resetting passwords and TOTP tokens. The severity is high because SMA 1000 is often used as a remote access point for users and administrators, so a compromise can open the internal network. The campaign is particularly concerning because it combines two complementary vectors, one pre-auth and one post-auth, expanding exploitation possibilities in real-world scenarios. For defenders, it is a short-term patching and hunting priority.

Microsoft described the attack as a CI/CD compromise exploited to distribute malware through trusted software, highlighting how the build chain is a highly powerful entry point. The event is relevant not only for developers using those packages, but for all organizations that treat npm and automated workflows as trusted channels. The combination of supply chain compromise, trust abuse, and payload persistence makes the case a classic example of systemic risk. It is also a strong signal that popular dependencies remain a primary target for attackers.

Another research effort showed a “confused deputy” in Google IdP through device code flow hijacking, with the possibility of transferring sessions and reaching invisible takeovers. These vectors are highly important because they bypass part of traditional telemetry and exploit the identity provider’s own logic. In parallel, campaigns such as Forg365 and EvilTokens use device code phishing and session theft to maintain persistent access to Microsoft 365. The result is a threat that no longer depends only on weak passwords, but on how authentication protocols are implemented and logged.

The issue is serious because it allows trust to be compromised at the firmware level, before the operating system can apply security controls. Different sources link the discovery to 11 vulnerable shims and multiple vulnerabilities in U-Boot, with impacts on routers, embedded devices, and critical infrastructure. This broadens the threat beyond PCs: smart cameras, controllers, and network appliances can also become stealth persistence vectors. The consequence is an urgent review of secure boot baselines, revocations, and firmware updates.

Both cases highlight that the damage is not only informational: when operational systems are hit, industrial continuity and customer supply are disrupted. In neither case, at least in the initial reports, were there complete public attributions or certain details about the ransomware group. However, the fact that product quality and safety were declared intact while operations stopped shows the typical trade-off of cyber-industrial crises. For companies in manufacturing and the food chain, operational resilience is now a security measure in every sense.

fraudulent investment platforms were dismantled, with estimated profits of up to 100 million euros per month or more than 140 million overall. In the United Kingdom, five people were charged over a caller ID spoofing service used in more than one million fraudulent calls. At the same time, threat intel reports show that tutorials on underground forums are increasing and that criminals continue to innovate in phishing, carding, and cash-out. These cases matter because they combine technical infrastructure, social engineering, and financial laundering into a single pipeline. For defenders and law enforcement, the challenge is to block not only access but also monetization.

Targets include individuals and entities connected to the FSB, bulletproof hosting providers such as Media Land, and VPN or cryptor services used by ransomware affiliates. The sanctions aim to disrupt the logistical support that enables groups such as Scattered Spider, ransomware operators, and state actors to move with greater impunity. These measures show that cyber deterrence is not only about malware and vulnerabilities, but also about the support companies that make the criminal ecosystem sustainable. Their relevance is high because they strike the attack supply chain and not just the final payload. Even if long-term effectiveness is difficult to measure, the coordinated pressure signals a maturing geopolitical response to cybercrime.

Campaigns rely on fake pages imitating CAPTCHA, browser updates, or meeting errors and push victims to execute commands in the terminal or the Run window. Microsoft and other researchers observed families such as ACR Stealer and TELEPUZ using ClickFix to steal cookies, tokens, documents, and enterprise credentials. At the same time, various analyses show that attackers are also integrating AI to generate more credible lures and automate phases of the chain. The result is a threat that often evades antivirus and traditional endpoint controls because it uses the user as the execution mechanism. Its relevance is high because the technique works on both Windows and macOS and continues to be reused in different contexts.